A security issue in NM-libreswan, where we fail to sanitize the VPN configuration from a local unprivileged user and pass it directly to Libreswan.

The libreswan connection configuration is simple key=value format, but we fail to check for or escape special characters, including newlines, which makes it possible for the user to trick us to treat values as key.

Unfortunately, there's one particular key that takes an executable command as an argument: leftupdown (couldn't find more in ipsec.conf(5)). We normally use it to specify the NM-libreswan callback, that would pass L3 configuration back to NM. It can be abused to execute arbitrary code.